Red Hat Bugzilla – Bug 54443
pam-0.75-14 - problem with > 8 char passwords
Last modified: 2005-10-31 17:00:50 EST
Description of Problem:
Updating from pam-0.75-14 does not work as expected when using NIS (DES
Up to pam-0.75-13 PAM would only use the first 8 characters even if
the user entered more than that.
In this new version, if a user enters more than 8 characters, all of them
This changes the expected behaviour of PAM and breaks existing installations.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Choose a password with more than 8 characters on your NIS server.
2. Install 7.2 with the new pam package.
3. Try to login entering all characters of your password. Login fails.
4. Using only the first 8 characters everything works fine.
Use only the first 8 characters.
This pam update changes the default behaviour. This must not happen, too
many things break. Especially do never change something like that in a .2
NIS server is a Red Hat 7.0 system. Passwords are DES encrypted.
Important because it breaks compatiblity with other Unixes and other Linuxes --
including older Red Hat releases. RHL needs to play nicely with others!
*** Bug 54489 has been marked as a duplicate of this bug. ***
That this affects passwords hashed with a non-MD5 (DES-style) crypt, so this
tends to affect environments using NIS more heavily than standalone machines or
systems using Kerberos or LDAP for authentication. (MD5 hashing is strongly
recommended whenever compatibility with systems which don't support is not an
This will be fixed in 0.75-15, which will show up in Raw Hide before release as
a bug-fix errata.
We use DES passwords mostly (DOH!) even though NIS isn't used.
Why? Because we also have other UNIX systems, to/from which we want to be able move users
fluently (e.g. copy the password in /etc/master). Some of those don't even support MD5 unfortunately.
So, I expect DES may still be used in more heterogenous environments.
The errata package for this (0.75-16) is going out now. Thanks!
*** Bug 55011 has been marked as a duplicate of this bug. ***
The summary is not accurate. The buggy behaviour occurs with passwords of
exactly 8 chars length, not just > 8 chars. E.g. "z2,K2=2aS" as a password
reliably reproduces the failure to authenticate bug (omit the quotes).
The summary should say:
pam-0.75-14 - problem with >= 8 char passwords
Ignore the last comment - I counted 8 and not 9 in the example password.
This seems related: After upgrading to RH7.2 and pam-0.75-19 I am able
to log into my NIS(on solaris) connected workstation just fine.
But after locking my screen with xlock,vlock or xscreensaver, I am
not able to unlock it again.
*** Bug 64234 has been marked as a duplicate of this bug. ***
Ok. GREAT. It works!
A little comment: In this page there no way to go back to the page where the
problem is explained. link: http://rhn.redhat.com/errata/RHBA-2001-127.html